Connect SSM with a client certificate

Watch the certificate setup walkthrough

Opens YouTube in a new tab. No YouTube player or tracking is loaded on this page.

Screenshots are cropped from the video walkthrough. Account fields and certificate identifiers are obscured where applicable. Labels may differ in your installed version; select an image to open it full-size.

Before you begin

• Have a Partner Center developer account, a linked Microsoft Entra tenant, and an Entra application associated with Partner Center with the required access.
• If tenant linking or application setup is incomplete, follow the API access and connection guide first. Ask the account owner or tenant administrator for help with steps you cannot access.
• If you already connect with a client secret, reuse that application's tenant ID and application (client) ID. Do not create another registration just to change the credential type.
• Run SSM and Windows PowerShell as the same Windows user for this Current User store demonstration.

Certificate authentication proves the application's identity without pasting a client-secret value into SSM. The public certificate is registered with Entra; the matching private key stays on this PC. Changing the credential does not replace the application's Partner Center permissions.

1. Create the demonstration certificate

The video creates a self-signed RSA certificate in the current user's Personal store, valid for six months, with a non-exportable private key. For production, follow your organization's certificate issuance, key protection, validity, and renewal requirements.

Open Windows PowerShell under the Windows account that runs SSM. Review and run this demonstration command:

$params = @{
    Type              = 'Custom'
    Subject           = 'CN=SSM-Certificate-Demo'
    FriendlyName      = 'SSM Certificate Demo'
    CertStoreLocation = 'Cert:\CurrentUser\My'
    Provider          = 'Microsoft Software Key Storage Provider'
    KeyAlgorithm      = 'RSA'
    KeyLength         = 2048
    HashAlgorithm     = 'SHA256'
    KeyUsage          = 'DigitalSignature'
    KeyExportPolicy   = 'NonExportable'
    NotAfter          = (Get-Date).AddMonths(6)
}

$cert = New-SelfSignedCertificate @params

$cert | Format-List Subject, NotAfter, HasPrivateKey

The output should show your certificate subject, its expiry date, and HasPrivateKey : True. The name is a recognizable demo label, not an application ID. This command creates a credential on this PC; it does not register it in Entra or grant Partner Center access.

2. Select the certificate in SSM

1. On SSM's connection page, select Client certificate.
2. Enter the tenant ID and client ID of the existing Entra application.
3. Leave Store set to Current user, then refresh the certificate list.
4. Select the certificate created for the demonstration.

SSM also supports the Local machine store. This walkthrough uses Cert:\CurrentUser\My; changing the selected store does not move a certificate or make its private key accessible to another user.

3. Inspect and export the public certificate

1. Select Info next to the selected certificate.
2. Review its subject, validity dates, RSA key size, and private-key status. A private key must be present; Test and Connect check whether SSM can actually use it.
3. Select Export public certificate and save the .cer file somewhere you can find for the upload.

4. Register the public certificate in Entra

1. In Partner Center, find the application under Account settings > User management > Microsoft Entra applications and copy its application ID.
2. Open Microsoft Entra admin center, go to App registrations, and search or filter by that client ID. Use the same tenant and registration as SSM, not a similarly named application.
3. On Overview, confirm the application (client) ID and directory (tenant) ID. Copy the tenant ID if needed.
4. Open Certificates & secrets > Certificates > Upload certificate.
5. Select the exported public .cer file, add a recognizable description, and select Add.
6. Confirm that the new certificate appears with the expected validity dates.

If you are migrating from a client secret, keep the existing credential until the certificate connection is verified and you have checked whether anything else still depends on it.

5. Test certificate authentication

Return to SSM and select Test. SSM uses the selected certificate to request an access token from Microsoft Entra.

A successful Test is not the complete connection check. It confirms that Entra accepted the certificate credential and issued a token. It does not by itself confirm the application's Partner Center permissions.

6. Connect and verify the catalog

1. Choose whether to enable Remember connection. In certificate mode, SSM retains the connection details and certificate reference; it does not copy the private key into the saved connection.
2. Select Connect and wait for Catalog to load.
3. Confirm that the products you expect are visible. Start with inspection; no edits or submissions are needed to verify this setup.

Expected result: the catalog loads using certificate-based authentication without entering a client-secret value. This confirms catalog access, not permission for every possible publishing action.

Another PC and certificate renewal

• The demo private key is non-exportable. Copying the public .cer file to another PC is not enough to authenticate there. Provision a suitable certificate and private key for that workstation, and register its public certificate with the same Entra application.
• Track expiry. Before the current certificate expires, prepare a replacement and register its public certificate with the same app registration.
• Select the replacement in SSM, run Test, and use Connect to verify catalog access before retiring the old credential. Check other clients' dependencies first.
• Do not share client-secret values, access tokens, or private-key files in comments, screenshots, or support requests.

If a step fails

• Certificate missing from the list: check the Windows user, selected store, and certificate validity, then refresh. For this demo, use Current user under the account that created the certificate.
• Private key missing or unusable: importing a public .cer alone does not provide the private key. SSM needs a valid RSA certificate with a private key it can use, a key of at least 2048 bits, and a compatible signing provider. The demo command uses Microsoft Software Key Storage Provider.
• Test fails: check the tenant ID and application (client) ID, confirm the matching public certificate was uploaded to that registration, and review expiry and private-key access. Do not use the registration's object ID as the client ID.
• Test succeeds but Connect fails: check that the same application is associated with the correct Partner Center account and has the required role. Certificate registration alone does not grant Store access.

If you need help, use SSM Support and describe the failed step and sanitized error without attaching credentials or private keys.

Next: publish an app or game

With the catalog connected, follow the publishing walkthrough for name reservation, packaging, listings, pricing, Partner Center handoffs, and publication.

For current platform details, see Microsoft's New-SelfSignedCertificate reference and app credential-management guide.